Attack Type: OAuth 2.0 device code phishing

Severity: High.

Targeted Accounts: Microsoft 365 / Azure AD (Entra ID) identities

Attack Chain:

• Initial Access → Phishing Delivery: Victims receive phishing emails impersonating trusted internal or third-party services. These messages typically contain embedded hyperlinks, shortened URLs, or QR codes that redirect the user to attacker-controlled infrastructure.

• User Interaction → Device Code Presentation: The phishing page displays a unique attacker-generated device code and instructs the victim to visit Microsoft’s legitimate device login portal (e.g.,
  https://microsoft.com/devicelogin) and enter the code, presenting it as a one-time verification or security confirmation step.

• OAuth Device Authorization → User Approval: When the user enters the attacker-provided code and authenticates, they unknowingly authorize the attacker-controlled Azure application via the OAuth 2.0 device authorization flow.

• Token Retrieval → Attacker Access Granted: The attacker’s OAuth client continuously polls Microsoft’s token endpoint and retrieves a valid access token as soon as the user authorizes the session.

• Post-Compromise Abuse → Account Takeover: The attacker now possesses a legitimate OAuth token that provides access to Microsoft 365 resources such as email, OneDrive, SharePoint, Teams, and directory data, often without additional MFA prompts or password entry.

Phishing Tooling Observed:

• SquarePhish2: Automates the OAuth device code attack flow, including QR code delivery, social engineering triggers, and token capture.

• Graphish phishing kit: Uses Azure App Registrations and reverse proxy servers to conduct adversary-in-the-middle attacks (AiTM)-style phishing, supporting credential and session hijacking, and the potential to bypass MFA protections in certain conditions.